proofbundle

Portable evidence for AI work, verifiable offline. Integrity, not truth

One file. No verification server. No network required.

Quick start · What it proves · Current release · Adoption review · Documentation

Current release

What changed, entry by entry, is in the CHANGELOG; what is in the cut and what moved out of it is in docs/release_scope. The version is on the PyPI badge above and not in this text, so this section cannot go stale.

The closing audit verdict of the last release was FIX_FIRST, not WITHSTANDS_DEEPGATE. The findings that stayed open are published in RESTRISIKO_600.md with the scope each statement of that round holds over, and the artefacts of the round are in audit_artifacts/600.

Quick start

Install the core verifier.

python -m pip install proofbundle

Requires Python 3.10 or newer. The core installs two dependencies, cryptography and rfc8785.

Download a real example receipt and verify it offline.

curl -fsSL \
  https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json \
  -o receipt.json

proofbundle verify receipt.json

The command uses the local file only. Its exit code is part of the public contract.

0  verified
1  verification failed
2  malformed input or usage error
3  relying party policy not met

That table is the contract of proofbundle verify. The statement-style commands (decision verify, outcome verify, relation-statement verify) carry their own exit contract in their own --help, and the meanings differ, until 6.2.0 sets one contract for all of them.

Run the tamper demo.

python -m pip install "proofbundle[eval]"
proofbundle demo

The demo checks an honest receipt, multiple tampered variants, and a sample swap. It exits nonzero if a tamper is accepted.

For a guided walkthrough, see docs/DEMO.md. For Inspect, see docs/INSPECT_HAPPY_PATH.md.

What a receipt proves

This boundary is the product. proofbundle makes a claim attributable and tamper evident without turning the claim into truth.

Read the full threat model and the project wide non claims.

Choose the path that matches your task

How it works

evaluation, review, decision, or action
                    │
                    ▼
      canonical statement and commitments
                    │
                    ▼
       signature and optional Merkle proofs
                    │
                    ▼
           one portable receipt file
                    │
                    ▼
        proofbundle verification offline
                    │
                    ▼
   separate verification axes and policy result

The verifier checks only the evidence supplied to it. Trust anchors, expected subjects, currentness information, and policy requirements come from the relying party.

Capabilities and maturity

proofbundle is a beta project. Shipped does not mean that every profile has the same maturity.

The full predicate inventory and maturity labels live in docs/predicates/README.md.

Security and trust

• The verifier uses cryptography for Ed25519 and rfc8785 for canonicalization. It does not implement its own cryptographic primitives.
• Correctness is checked against external RFC 6962 vectors and a real Sigstore Rekor proof, not only against the project's own receipts.
• The test suite sits behind a mutation gate and property based parser fuzzing.
• The receipt signature is Ed25519 and is not post quantum. Post quantum coverage today is limited to witness side ML-DSA-44 cosignatures, plus an experimental ML-DSA path in the renewal layer (pqsig.py, EXPERIMENTAL, ADR 0006), which renews a receipt rather than signing its payload. A post quantum payload signature is on the roadmap and not yet built. Detail in docs/ANCHORS.md.
• Releases are built once, carry SLSA build provenance, and are published through PyPI Trusted Publishing, where PyPI records PEP 740 attestations for the same bytes.
• A second, independent verifier written in Rust cross-checks the conformance corpus. It is advisory: differential agreement on the recorded vectors, not a correctness proof of either implementation, and it does not ship in the package.
• The conformance corpus includes positive controls and counter proofs. Read what it does and does not establish in CONFORMANCE.md.
• The 30 minute adversarial adoption path is in docs/REVIEWERS.md.
• Security reports follow SECURITY.md.
• Release specific audit artefacts and residual risks remain visible rather than being folded into a single green status.

OpenSSF Scorecard

The aggregate score is a live heuristic, not a product verdict. Several checks score zero for reasons that are written down rather than hidden, one sentence per check, in docs/SCORECARD.md. The OpenSSF self assessment walks the Best Practices criteria honestly.

Standards and interoperability

proofbundle is a small offline receipt layer that complements, rather than replaces, systems such as in-toto, Sigstore, SCITT, transparency logs, trusted execution environments, and independent reproduction.

• INTEROP.md compares the boundaries tool by tool.
• docs/RECEIPT_ENVELOPE_PROFILE.md defines the portable envelope profile.
• A second implementation, CSOAI-ORG/inspect-receipts, was measured against R1 to R4 of that profile in issue #147 on 2026-09-05 at commit cc8d6219; the result is recorded in the profile.
• docs/IN_TOTO_PROFILE.md describes the in-toto mapping.
• docs/SCITT_CPB_MAPPING.md records the SCITT mapping.
• docs/RELATED_WORK.md holds the research neighbourhood.

Documentation

Scope

proofbundle is not a hosted transparency service, a complete in-toto client, a trusted execution environment, a consensus system, or a compliance product by itself.

It is the portable, standards oriented receipt layer between an evidence producer and a relying party.

Roadmap, stated as not yet built. A post quantum payload signature, and a CLI flag to select the content root algorithm, jcs-sha256-v1 is the signed default today.

Citation

Machine readable citation metadata is in CITATION.cff.

The archival software record uses concept DOI 10.5281/zenodo.21110642. The Technical Note uses concept DOI 10.5281/zenodo.21230466; its latest published revision is 6.0.0, version DOI 10.5281/zenodo.22730162, deposited 2026-09-12. The preceding revision 5.0.0 has version DOI 10.5281/zenodo.22209091.

Contributing

Read CONTRIBUTING.md and the Code of Conduct.

Good first issues use the good-first-issue label. Security findings follow SECURITY.md.

The verifier core aims to remain small, dependency light, and auditable.

License

MIT, see LICENSE.

_{proofbundle is part of b7n0de, Verified AI Work · b7n0de.com}